ArcSearch iOS CVE-2026-18534

The victim must be running ArcSearch for iOS on a version prior to 1.48.0 and must navigate to an attacker-controlled page - via a tapped link in a phishing message, a malicious advertisement, or a redirect from a compromised legitimate site. The page must initiate a scroll programmatically to trigger the address bar suppression. No authentication is required on the attacker's side (PR:N). Exploitation is limited to iOS; no other platforms are in scope. The attack requires the victim to take action within the spoofed interface (e.g., entering credentials), meaning passive page visits alone do not result in exploitation. ArcSearch must be the active browser handling the request - users who default to Safari or Chrome on the same device are unaffected.

The CVSS 7.4 score is driven by Scope Changed (S:C) and High Integrity impact (I:H), which accurately reflects that this vulnerability breaches the boundary between web content and browser chrome - a meaningful security boundary. Attack complexity is Low (AC:L) and no privileges are required (PR:N), meaning any web server operator can host a triggering page. User interaction (UI:R) is the primary limiting factor: a victim must navigate to the malicious page. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified; however, the low barrier to exploitation suggests it should not be dismissed. There is no CISA KEV listing and no public POC at time of analysis, which moderates urgency compared to the raw CVSS score. This class of address bar spoofing vulnerability has historically been used in targeted credential phishing campaigns rather than mass exploitation. Even a small municipal IT team should treat mobile browser spoofing flaws as meaningful given the prevalence of BYOD and mobile phishing; the risk is not theoretical but is bounded by the requirement for user interaction and ArcSearch's niche market share relative to Safari or Chrome on iOS.

An attacker hosts a malicious webpage that immediately triggers a programmatic scroll upon load, causing ArcSearch's address bar to collapse and remain hidden. The page then renders a convincing fake address bar showing a legitimate domain (e.g., a bank or corporate SSO portal) in the now-unobstructed viewport. A victim who tapped a phishing link - delivered via SMS, email, or social media - and is using an unpatched version of ArcSearch sees no visual cue that the address bar is missing or spoofed, and may enter credentials into the attacker-controlled form. No public POC has been identified, but the technique requires only standard JavaScript scroll APIs.